62cbba2e2ba1eb5d0267676e80db74e69d93633a15f43a1b8f41d0075a89237b | Triage

Sharing

General

Target

8b1b6f9ff9745bb3f00b89d20bb6d23e_JaffaCakes118
Size

15KB
Sample

240811-t11ppssarb
MD5

8b1b6f9ff9745bb3f00b89d20bb6d23e
SHA1

debe2f14c7e9c6323f1a50171025f3f14d9bb534
SHA256

62cbba2e2ba1eb5d0267676e80db74e69d93633a15f43a1b8f41d0075a89237b
SHA512

3ab054e34ef59155cafc2e23d0cdb07ab04b697bbb3f5ade1d4a51e56a3a05af79d8d3953d54a3df5d2601209c5d0860f3c9b96698f3f358db18bd0618dda97f
SSDEEP

384:9A4Ej3e+Xa6CBymz6Hs4PvUhTZDWEGCFDh7L:XrByXFPoCEGCFDF

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  
  8b1b6f9ff9745bb3f00b89d20bb6d23e_JaffaCakes118
- Size
  
  15KB
- MD5
  
  8b1b6f9ff9745bb3f00b89d20bb6d23e
- SHA1
  
  debe2f14c7e9c6323f1a50171025f3f14d9bb534
- SHA256
  
  62cbba2e2ba1eb5d0267676e80db74e69d93633a15f43a1b8f41d0075a89237b
- SHA512
  
  3ab054e34ef59155cafc2e23d0cdb07ab04b697bbb3f5ade1d4a51e56a3a05af79d8d3953d54a3df5d2601209c5d0860f3c9b96698f3f358db18bd0618dda97f
- SSDEEP
  
  384:9A4Ej3e+Xa6CBymz6Hs4PvUhTZDWEGCFDh7L:XrByXFPoCEGCFDF
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery

behavioral2

defense_evasiondiscovery